Methods and systems of secure connections for joining hybrid cellular and non-cellular networks

ABSTRACT

The subject matter describes devices, networks, systems, media, and methods to create secure communications between wireless devices and cellular networks, where the wireless devices communicate with the cellular networks via multi-hopping methods in non-cellular networks.

CROSS REFERENCE TO RELATED APPLICATIONS

This application is a U.S. National Stage Entry of InternationalApplication No. PCT/US2014/070120, filed in the U.S. Receiving Office onDec. 12, 2014, which claims the benefit of U.S. Application Ser. Nos.61/915,949, filed Dec. 13, 2013, and 61/916,334, filed Dec. 16, 2013,which are hereby incorporated by reference in their entirety.

BACKGROUND OF THE INVENTION

Cellular communications have gained much popularity since 1990s.Traditionally, cellular networks are connected to public switchedtelephone network (PSTN) and are dedicated to voice communications. Withadvanced packet switching technologies, any raw signals can be formed inpackets which can flow from the sender to the destination via thecellular networks and non-cellular networks. On the other hand, themanufacturing cost of cell phones, or called mobile phones, hasdecreased significantly, so mobile phones become affordable. It isbelieved that the mobile phones have penetrated more than 85% of theglobal population. Furthermore, more functionalities are added to mobilephones, leading the boundaries between mobile phones and personalcomputing devices to disappear. Many mobiles phones have now becomesmartphones or personal mobile computers. The smartphones allowsubscribers not only to talk but also to enjoy the use of the Internet.

Due to a large volume of subscribers using smartphones, the demand ofcellular transmission increases exponentially. However, the bandwidthsof cellular networks are limited. A typical solution to the problem ofbandwidth deficiency is to install more cellular base stations.Nevertheless, in the greater metropolitan areas, e.g., New York City,Chicago, Los Angeles, London, and Tokyo, there are sparse or no spacesto install more cellular base stations. Even though installing more basestations is feasible, users located at the “marginal-to-inoperativeregions,” such as the coverage edges of base stations, hilly terrain,concrete walls, or tall buildings, still face weak or blocked signals.As a sequel, a new way to increase the cellular coverage is necessary.

SUMMARY OF THE INVENTION

Advantages of the subject matter described herein utilize multi-hoppingsystems in non-cellular networks to securely connect wireless devices tocellular networks. Non-cellular networks, such as wireless local/widearea networks, Bluetooth networks and the Internet, are ubiquitous andare also directly or indirectly connected with cellular networks. Thesubject matter described herein exploits the hybrid of cellular andnon-cellular networks to expand the coverage of cellular base stations.When a wireless device participates in a hybrid network, the subjectmethod can configure the device's non-cellular interface to originate orrelay a cellular communication via hopping on the non-cellular network.When connecting the device to a cellular network via hopping onto anon-cellular network, the device creates a secure tunnel between thedevice and the core of the cellular network. The secure tunnel canprotect the data packets from being eavesdropped by another deviceduring the communication path.

In one aspect, described herein is a system that comprises: wirelesslyconnecting a wireless device to a cellular network by single-hopping ormulti-hopping to a sink device in a non-cellular network, andestablishing a security tunnel in the wireless communication between thewireless device and a first gateway, which is located in the cellularnetwork. The establishment of the security tunnel is based on a securitykey assigned (non-limiting examples include: by the cellular network, bya cellular operator, by an end-user, and/or by a certificate authority)to the wireless device. The system further comprises transmitting datapackets between the wireless device and the first gateway; thetransmission comprises encrypting by the wireless device the datapackets, sending by the wireless device the encrypted data packets overthe security tunnel to the first gateway, receiving by the first gatewaythe encrypted data packets, decrypting by the first gateway theencrypted data packets, and updating a network connection table by thefirst gateway. In some embodiments, the system further comprises sendingby the first gateway the decrypted data packets to the Internet. In someembodiments, the first gateway sends the decrypted data packets to asecond gateway that in turn sends the decrypted data packets to theInternet.

When data packets are sent from the Internet to the wireless device, thesystem comprises receiving the data packets by the first gateway.Alternatively, the data packets can be sent from the Internet to thesecond gateway that in turn sends the packets to the first gateway. Thesystem further comprises transmitting data packets between the firstgateway and the wireless device; the transmission comprises encryptingby the first gateway the data packets, sending by the first gateway theencrypted data packets over the security tunnel to the wireless device,receiving by the wireless device the encrypted data packets, anddecrypting by the wireless device the encrypted data packets.

The transmission of data packets between the wireless device and thefirst gateway and/or the second gateway involves billing the user of thewireless device the amount of data packets being sent. Using the hoppingtechnologies, the sink/relaying devices allowing the wireless devices tohop onto the non-cellular network also transfer the same amount of datapackets sent/received by the wireless device. However, the courtesy ofthe sink/relaying devices should not be billed for the amount of datarelayed. Therefore, the method further requests the first gateway and/orthe second gateway to delete a billing record of the sink/relayingdevice.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 shows a non-limiting example of a hopping system; in this case,the sink device relays the cellular communication to the node devicesthat connect to the sink device by single-hopping or multi-hopping onthe non-cellular network.

FIG. 2 shows a non-limiting example of a multi-hop, hybrid network; inthis case, the node device hops onto a sink device which in turn relaysthe signals to the cellular base station and one or more than onegateway in the cellular network.

FIG. 3 shows a non-limiting example of a configuration of a hybridnetwork; in this case, the node device creates a security tunnel withthe ePDG gateway.

FIG. 4 shows a non-limiting example of a configuration of a hybridnetwork; in this case, the node device creates a security tunnel withthe IP security gateway which is placed between the SGW and PGWgateways.

FIG. 5 shows a non-limiting example of a configuration of a hybridnetwork; in this case, the node device creates a security tunnel withthe IP security gateway which is placed before the SGW and PGW gateways.

FIG. 6 shows a non-limiting example of a configuration of a hybridnetwork; in this case, the node device creates a security tunnel withthe PGW gateway.

FIG. 7 shows a non-limiting example of a configuration of an inter-RAThybrid network; in this case, the node device operates on the HSPAprotocol and the cellular network operates on the LTE protocol with SGW,PGW, and ePDG gateways.

FIG. 8 shows a non-limiting example of a configuration of an inter-RAThybrid network; in this case, the node device operates on the LTEprotocol and the cellular network operates on the HSPA protocol withSGSN, PGW, and ePDG gateways.

FIG. 9 shows a non-limiting example of a configuration of an inter-RAThybrid network; in this case, the node device operates on the HSPAprotocol and the cellular network operates on the LTE protocol with SGW,PGW, TTG, and GGSN gateways.

FIG. 10 shows a non-limiting example of a configuration of an inter-RAThybrid network; in this case, the node device operates on the LTEprotocol and the cellular network operates on the HSPA protocol withSGSN, GGSN, ePDG and PGW gateways.

FIG. 11 shows a non-limiting example of a configuration of an inter-RAThybrid network; in this case, the node device operates on the LTEprotocol and the cellular network operates on the HSPA protocol withSGSN, GGSN and TTG gateways.

FIG. 12 shows a non-limiting example of a configuration of an inter-RAThybrid network; in this case, the node device operates on the HSPA orEDGE protocol and the cellular network operates on the LTE protocol withSGW, IPsec and PGW gateways.

FIG. 13 shows a non-limiting example of a configuration of an inter-RAThybrid network; in this case, the node device operates on the LTEprotocol and the cellular network operates on the HSPA or EDGE protocolwith SGW, IPsec and PGW gateways.

FIG. 14 shows a non-limiting example of a configuration of an inter-RAThybrid network; in this case, the node device operates on the HSPA orEDGE protocol and the cellular network operates on the LTE protocol withthe IPsec gateway placed before the SGW and PGW gateways.

FIG. 15 shows a non-limiting example of a configuration of an inter-RAThybrid network; in this case, the node device operates on the LTEprotocol and the cellular network operates on the HSPA or EDGE protocolwith the IPsec gateway placed before the SGW and PGW gateways.

FIG. 16 shows a non-limiting example of most recent path intelligence;in this case, the ePDG handles the most recent path tables.

FIG. 17 shows a non-limiting example of most recent path intelligence;in this case, the PGW handles the most recent path tables.

FIG. 18 shows a non-limiting example of most recent path intelligence;in this case, the node device has direct access to the cellular networkand the PGW handles the most recent path tables.

FIG. 19 shows a non-limiting example of a configuration of a hybridnetwork; in this case, the node device accesses the cellular networkdirectly without hopping, and no security tunnel is created.

FIG. 20 shows a non-limiting example of a data protocol in a hybridnetwork; in this case, various devices handle data ports and IPaddresses during data transmission, and the evolved packet data gatewayfacilitates modification of the billing records.

FIG. 21 shows a non-limiting example of a data protocol in a hybridnetwork; in this case, various devices handle data ports and IPaddresses during data transmission, and the packet gateway handles thebilling records.

DETAILED DESCRIPTION OF THE INVENTION

Cellular communications have gained much popularity since 1990s. Theprinciple of cellular communications is to divide a broad land area intoa number of regular shaped cells, for example hexagonal, square, orcircular shapes. Each of the cells is assigned one or more cellular basestations or cellular towers as hubs to manage wireless connectivitybetween mobile phones (or called cell phones) and the base stations. Thebase stations are further connected to public switched telephone network(PSTN), so traditionally the mobile phones in cellular networks werededicated to voice communications.

With the advent of packet switching technologies, raw signals (e.g.,voice, sound, and scenes) can be formed in packets which can flow from asender to a destination without a direct link between the sender and thedestination. When cellular networks are deployed with packet switchingtechnologies, a mobile computing device can connect to the Internet orother data networks via a data cellular network. Thanks to modernsemiconductor engineering, the sizes of electronic circuitries keepshrinking. When a mobile phone is equipped with electronic chips forhandling traditional cellular networks and data cellular networks, theboundary between mobile phone and mobile computing device becomesillusive. Most modern mobile phones are also mobile computing devices.

The manufacturing cost of mobile devices has decreased significantly.Mobile devices have become affordable to the general public. It isbelieved that the mobile devices have penetrated more than 85% of theglobal population. With a dramatically increasing number of mobiledevice users, telecommunication providers face a challenge to expandtheir coverage. Moreover, more functionalities (e.g., camera, websearch, emails, maps, Internet surfing) have been added to mobile phonesand mobile devices. Mobile device users demand more bandwidth to enjoythe added functionalities. Such a demand compounds the challenge facedby the telecommunication providers.

To address the surging bandwidth demand in cellular networks, a typicalsolution is to install more cellular base stations. Nevertheless, in thegreater metropolitan areas, by way of non-limiting examples, such as NewYork City, Chicago, Los Angeles, London, and Tokyo, there are sparse orno spaces to install more cellular base stations. In the cases whereinstalling more base stations is feasible, users located at the“marginal-to-inoperative regions,” such as the coverage edges of basestations, hilly terrain, concrete walls, or tall buildings, still faceweak or blocked signals. As a sequel, a new way to increase the cellularcoverage is necessary.

In typical cellular communication systems, a mobile device directlycommunicates with a cellular base station. In other words, the deviceconnects to the cellular base station via a “single hop,” where thesignals are transmitted and received directly between the device and thecellular base station without being mediated or relayed through anintermediary device. Based on the single hopping communication, themaximum number of mobile phones simultaneously connecting to the basestation is limited because the bandwidth of the base station is limited.Although sophisticated schemes of modulation and error-correcting codescan be adopted, the data rates need to be sacrificed.

In addition to cellular networks, there exist various non-cellularwireless networks, for instance, but not limited to, wireless local areanetworks, wireless wide area networks, Bluetooth networks, and ingeneral the Internet. Modern technologies allow both cellular interfaceand non-cellular interface to be embedded in a mobile device. In otherwords, a modern mobile device can participate in a cellular network viathe cellular interface, or participate in a non-cellular network via thenon-cellular interface. While the two interfaces independently sit inthe same mobile device, the subject matter described herein exploitsboth types of interfaces to expand the coverage of cellular networks.

The subject matter described herein solves the aforementioned problemsby using multi-hop schemes in a hybrid of cellular networks andnon-cellular networks. The subject matter can be applied to someembodiments of not only mobile devices but also generic wirelessdevices. To expand the coverage of a cellular communication system, afirst wireless device with a poor cellular signal uses its non-cellularinterface to communicate to a second wireless device which has a goodcellular signal and relays the signals from the first wireless device tothe cellular base station. In such embodiments, the cellular resources,such as data rate and bandwidth, of the second wireless device is sharedwith the first wireless device. The first wireless device successfullycommunicates to the cellular base station via two hops: hopping to thesecond wireless device that in turn hops to the cellular base station.The “double-hop” connectivity in these embodiments can be extended to a“multi-hop” connectivity in other embodiments. For example, the firstwireless device can hop to the second wireless device, then to a thirdwireless device, and finally to a cellular base station. The number ofhops can be as many as possible, as long as some criteria is satisfied,by way of non-limiting examples, such as battery life, noise level,interference level, data rate, and bandwidth.

The hopping technologies allow the cellular networks to expand theircoverage. However, the devices (by way of non-limiting examples,smartphones, routers, switches, gateways, computers, and/or portableelectronic devices) transferring the data between an end terminal and acellular core network may eavesdrop a signal and/or a data packet.Therefore, the subject system described herein can further create asecurity tunnel between the terminal wireless device and a first gatewaylocated in the cellular core network. The creation of the securitytunnel is based on a security key assigned (non-limiting examplesinclude: by the cellular network, by a cellular operator, by anend-user, and/or by a certificate authority) to the wireless device. Thesystem further comprises transmitting data packets between the wirelessdevice and the first gateway; the transmission comprises encrypting bythe wireless device the data packets, sending by the wireless device theencrypted data packets over the security tunnel to the first gateway,receiving by the first gateway the encrypted data packets, decrypting bythe first gateway the encrypted data packets, and updating a networkconnection table by the first gateway. Non-limiting examples of networkconnection tables include routing table, ARP table, and bearer table. Insome embodiments, the system further comprises sending by the firstgateway the decrypted data packets to the Internet. In some embodiments,the first gateway sends the decrypted data packets to a second gatewaythat in turn sends the decrypted data packets to the Internet.

The subject system can further handle data packets sent from theInternet to the wireless device. The first gateway in the systemreceives the data packets from the Internet. Alternatively, the datapackets can be sent from the Internet to the second gateway that in turnsends the packets to the first gateway. The system further comprisestransmitting data packets between the first gateway and the wirelessdevice; the transmission comprises encrypting by the first gateway thedata packets, sending by the first gateway the encrypted data packetsover the security tunnel to the wireless device, receiving by thewireless device the encrypted data packets, and decrypting by thewireless device the encrypted data packets.

The transmission of data packets between the wireless device and thefirst gateway and/or the second gateway involves billing the user of thewireless device the amount of data packets being sent. Using the hoppingtechnologies, the sink/relaying devices allowing the wireless devices tohop onto the non-cellular network also transfer the same amount of datapackets sent and received by the wireless device. However, the courtesyof the sink/relaying devices should not be billed for the amount of datarelayed. Therefore, the system further requests the first gateway(and/or the second gateway, if applicable) to delete a billing record ofthe sink/relaying devices. By way of non-limiting examples, a billingrecord includes the amount of data sent and received by a device via thecellular network, the amount of time spent on using cellular networkresources, or a combination of them.

In some embodiments, the system described herein comprisesnon-transitory computer-readable storage media encoded with a computerprogram including instructions executable by a processor of a device, orprocessors of a plurality of devices to create an application. Theapplication comprises a software module configured to establish andmaintain a communication between a wireless device and a cellularnetwork via hopping to other sink/relaying devices in a non-cellularnetwork; a software module configured to create a security tunnelbetween the terminal wireless device and a first gateway, where thefirst gateway is located in the cellular network. The creation of thesecurity tunnel is based on a security key assigned (non-limitingexamples include: by the cellular network, by a cellular operator, by anend-user, and/or by a certificate authority) to the wireless device. Insome embodiments, the application further comprises a software moduleconfigured to transmit data packets between the wireless device and thefirst gateway; the transmission comprises encrypting by the wirelessdevice the data packets, and sending by the wireless device theencrypted data packets over the security tunnel to the first gateway. Insome embodiments, the application comprises a software module configuredby the first gateway to receive the encrypted data packets, decrypt theencrypted data packets, and update a network connection table. In someembodiments, the application further comprises a software moduleconfigured by the first gateway to send the decrypted data packets tothe Internet. In some embodiments, the first gateway sends the decrypteddata packets to a second gateway that in turn sends the decrypted datapackets to the Internet.

In some embodiments, the application further comprises software modulesto handle data packets sent from the Internet to the wireless device.The application comprises a software module configured by the firstgateway to receive the data packets from the Internet. Alternatively,the data packets can be sent from the Internet to the second gatewaythat in turn sends the packets to the first gateway. In furtherembodiments, the application comprises a software module configured bythe first gateway to transmit the data packets to the wireless device byencrypting the data packets, and sending the encrypted data packets overthe security tunnel to the wireless device. In further embodiments, theapplication includes a software module configured by the wireless deviceto receive the encrypted data packets, and decrypt the encrypted datapackets.

In some embodiments, the application comprises a software moduleconfigured to handle billing records. The transmission of data packetsbetween the wireless device and the first gateway and/or the secondgateway involves billing the user of the wireless device the amount ofdata packets being sent. Using the hopping technologies, thesink/relaying devices allowing the wireless devices to hop onto thenon-cellular network also transfer the same amount of data packets sentand received by the wireless device. However, the courtesy of thesink/relaying devices should not be billed for the amount of datarelayed. Therefore, the application further comprises a software moduleconfigured to request the first gateway (and/or the second gateway, ifapplicable) to delete a billing record of the sink/relaying devices.

In another aspect, disclosed is a computer-implemented method/systemcomprising: (a) connecting a wireless device to a cellular network bysingle-hopping or multi-hopping to a sink device in a non-cellularnetwork; and (b) establishing a security tunnel between the wirelessdevice and a first gateway. In some embodiments, the first gatewaycomprises one or more of the following: an evolved packet data gateway,a packet data gateway, and an IPsec gateway. In some embodiments,establishing the security tunnel comprises a key assigned to thewireless device by the cellular network. In additional embodiments, themethod/system comprises (a) encrypting by the wireless device a firstdata packet; (b) sending by the wireless device the encrypted first datapacket over the security tunnel to the first gateway; (c) receiving bythe first gateway the encrypted first data packet; (c) decrypting by thefirst gateway the encrypted first data packet; and (d) updating anetwork connection table by the first gateway. The method/system furthercomprises sending by the first gateway the decrypted first data packetto the Internet. In addition, the method/system comprises that the firstgateway deletes a first billing record of the sink device. In someinstances, the method/system comprises sending by the first gateway thedecrypted first data packet to a second gateway. The method/systemcomprises that the first gateway requests the second gateway to deletethe first billing record of the sink device. The method/system comprisesthat the second gateway does not bill a first tunneled data packetdestinated to or sourced from the first gateway. The second gatewaycomprises a packet gateway. In further embodiments, the method furthercomprises sending by the second gateway the decrypted first data packetto the Internet. In further embodiments, the method/system furthercomprises receiving by the first gateway a second data packet from theInternet. The method/system comprises receiving by the second gateway asecond data packet from the Internet. The method/system comprisessending by the second gateway the second data packet to the firstgateway. Additionally, the method comprises: (a) encrypting by the firstgateway the second data packet; (b) sending by the first gateway theencrypted second data packet over the security tunnel to the wirelessdevice; (c) receiving by the wireless device the encrypted second datapacket; and (d) decrypting by the wireless device the encrypted seconddata packet. The method/system further comprises modifying by the firstgateway a destination address of the second data packet. Themethod/system comprises that the first gateway deleting a second billingrecord of the sink device. The method/system comprises that the firstgateway requests the second gateway to delete a second billing record ofthe sink device. The method/system comprises that the second gatewaydoes not bill a second tunneled data packet destinated to or sourcedfrom the first gateway.

Certain Definitions

Unless otherwise defined, all technical terms used herein have the samemeaning as commonly understood by one of ordinary skill in the art towhich this invention belongs. As used in this specification and theappended claims, the singular forms “a,” “an,” and “the” include pluralreferences unless the context clearly dictates otherwise. Any referenceto “or” herein is intended to encompass “and/or” unless otherwisestated.

Overarching Method/System Design

The overarching method/system described herein comprises: (a) connectinga wireless device to a cellular network by single-hopping ormulti-hopping to a sink device in a non-cellular network; and (b)establishing a security tunnel between the wireless device and a firstgateway. The first gateway comprises one or more of: an evolved packetdata gateway, packet data gateway, and IPsec gateway. In someembodiments, establishing the security tunnel is based on a key assignedto the wireless device by the cellular network.

In additional embodiments, The method/system comprises: (a) encryptingby the wireless device a first data packet; (b) sending by the wirelessdevice the encrypted first data packet over the security tunnel to thefirst gateway; (c) receiving by the first gateway the encrypted firstdata packet; (d) decrypting by the first gateway the encrypted firstdata packet; and (e) updating a network connection table by the firstgateway. In further embodiments, the method/system comprises one or moreof: (a) modifying by the first gateway a source address of the decryptedfirst data packet, (b) sending by the first gateway the decrypted firstdata packet to the Internet, (c) sending by the first gateway thedecrypted first data packet to a second gateway.

Furthermore, the method/system in some embodiments comprises deleting bythe first gateway a first billing record of the sink device. In somecases, the method/system comprises sending by the first gateway arequest to the second gateway to delete a first billing record of thesink device. In some embodiments, the method/system comprises deeppacket inspecting by the second gateway so that the second gateway doesnot create a first billing record of the sink device. In someimplementations, the method/system comprises sending by the secondgateway the decrypted first data packet to the Internet.

Non-limiting examples of the second gateway include a packet datagateway. In some examples, the second gateway (e.g. PGW) uses deeppacket inspection (e.g. a whitelist rule) so that it does not createbilling records for tunneled packets (e.g. IPsec tunneled packets)destined to (e.g. destination IP address of the tunneled packets matchesthat of the first gateway) or sourced from (e.g. source IP address ofthe tunneled packets matches that of the first gateway) the firstgateway (e.g. ePDG).

In some embodiments, the method/system further comprises receiving bythe first gateway a second data packet from the Internet. Alternatively,the second gateway receives a second data packet from the Internet andsends the second data packet to the first gateway. In some embodiments,the first gateway modifies a destination address of the second datapacket. In additional embodiments, the method/system comprises (a)encrypting by the first gateway the second data packet; (b) sending bythe first gateway the encrypted second data packet over the securitytunnel to the wireless device; (c) receiving by the wireless device theencrypted second data packet; and (d) decrypting by the wireless devicethe encrypted second data packet.

Further embodiments following the previous paragraph include one or moreof the following: (a) deleting by the first gateway a second billingrecord of the sink device, (b) sending by the first gateway a request tothe second gateway to delete a second billing record of the sink device,and (c) deep packet inspecting by the second gateway so that the secondgateway does not create a second billing record of the sink device.

Wireless Device

In some embodiments, the media, devices, networks, systems, and methodsdescribed herein include one or more wireless devices. Suitable wirelessdevices are, by way of non-limiting examples, mobile phones, mobilecomputing devices, smartphones, portable computers, tablet computers,mobile computers, hot spots, routers, gateways, switches, cameras, audiorecorders, video recorders, music players, video players, portableelectronic devices, and wearable electronic devices. Alternatively, thewireless devices comprise non-portable devices containing cellularinterfaces and/or non-cellular interfaces; by way of a non-limitingexample, a computing device has an adaptor for cellular communicationand another adaptor for non-cellular communication.

In some embodiments, a wireless device used by the subject matterdescribed herein is equipped with a non-cellular interface only; i.e.,the device does not comprise a cellular interface. With appropriateconfiguration, the wireless device can utilize the non-cellularinterface to connect to another wireless device that relays the signalsto a cellular network. For instance, mobile computing devices (e.g.,iPads) equipped with only non-cellular interfaces (e.g., Wi-Fi chipsets)can be embodied.

In some embodiments, the wireless devices on a hybrid network describedin the subject matter are of the same type. By way of non-limitingexamples, the wireless devices could be all mobile phones, or portablecomputing devices. In other embodiments, the types of the wirelessdevices on a hybrid network are mixed. For instance, by way of anon-limiting example, a wireless device includes a smartphone, anotherwireless device includes a laptop, and another wireless device includesa Wi-Fi hot spot.

In some embodiments, the media, devices, networks, systems, and methodsdescribed herein include a wireless device equipped with a digitalprocessor, or use of the same. In further embodiments, the digitalprocessor includes one or more hardware central processing units (CPUs)that carry out the device's functions. In still further embodiments, thedigital processor further comprises an operating system configured toperform executable instructions.

In some embodiments, the wireless device includes an operating systemconfigured to perform executable instructions. The operating system is,for example, software, including programs and data, which manages thedevice's hardware and provides services for execution of applications.Those of skill in the art will recognize that suitable server operatingsystems include, by way of non-limiting examples, FreeBSD, OpenBSD,NetBSD®, Linux, Apple® Mac OS X Server®, Oracle® Solaris®, WindowsServer®, and Novell® NetWare®. Those of skill in the art will recognizethat suitable personal computer operating systems include, by way ofnon-limiting examples, Microsoft® Windows®, Apple® Mac OS X®, UNIX®, andUNIX-like operating systems such as GNU/Linux®. In some embodiments, theoperating system is provided by cloud computing. Those of skill in theart will also recognize that suitable mobile smart phone operatingsystems include, by way of non-limiting examples, Nokia® Symbian® OS,Apple® iOS®, Research In Motion® BlackBerry OS®, Google® Android®,Microsoft® Windows Phone® OS, Microsoft® Windows Mobile® OS, Linux®, andPalm® WebOS®.

In some embodiments, the wireless device includes a storage and/ormemory device. The storage and/or memory device is one or more physicalapparatuses used to store data or programs on a temporary or permanentbasis. In some embodiments, the storage device is volatile memory andrequires power to maintain stored information. In some embodiments, thedevice is non-volatile memory and retains stored information when thewireless device is not powered. In further embodiments, the non-volatilememory comprises flash memory. In some embodiments, the non-volatilememory comprises dynamic random-access memory (DRAM). In someembodiments, the non-volatile memory comprises ferroelectric randomaccess memory (FRAM). In some embodiments, the non-volatile memorycomprises phase-change random access memory (PRAM). In otherembodiments, the storage device includes, by way of non-limitingexamples, CD-ROMs, DVDs, flash memory devices, magnetic disk drives,magnetic tapes drives, optical disk drives, and cloud computing basedstorage. In further embodiments, the storage and/or memory device is acombination of devices such as those disclosed herein.

In some embodiments, the wireless device includes a display to sendvisual information to a user. In some embodiments, the display is acathode ray tube (CRT). In some embodiments, the display is a liquidcrystal display (LCD). In further embodiments, the display is a thinfilm transistor liquid crystal display (TFT-LCD). In some embodiments,the display is an organic light emitting diode (OLED) display. Invarious further embodiments, on OLED display is a passive-matrix OLED(PMOLED) or active-matrix OLED (AMOLED) display. In some embodiments,the display is a plasma display. In other embodiments, the display is avideo projector. In still further embodiments, the display is acombination of devices such as those disclosed herein.

In some embodiments, the wireless device includes an input device toreceive information from a user. In some embodiments, the input deviceis a keyboard. In some embodiments, the input device is a pointingdevice including, by way of non-limiting examples, a mouse, trackball,track pad, joystick, game controller, or stylus. In some embodiments,the input device is a touch screen or a multi-touch screen. In otherembodiments, the input device is a microphone to capture voice or othersound input. In other embodiments, the input device is a video camera tocapture motion or visual input. In still further embodiments, the inputdevice is a combination of devices such as those disclosed herein.

Hybrid/Multi-Hop Network

In some embodiments, the media, devices, networks, systems, and methodsdescribed herein include a wireless device as a hybrid, multi-hopnetwork. FIG. 1 is a non-limiting example illustrating some embodimentsof a hybrid, multi-hop network. Referring to FIG. 1, the wireless device102 directly connects to a cellular base station 101. The communicationnetwork between the base station 101 and device 102 is based on acellular communication protocol, namely forming a cellular network. Thedevice 102 embodied in FIG. 1 connects to the base station 101 via asingle hop.

Referring to FIG. 1, the wireless device 103 does not have optimalcellular signals directly connecting to the base station 101. However,the signals of the device 103 can hop onto the device 102 which in turnrelays the signals to the base station 101. The communication betweenthe device 103 and the base station 101 is a two-hop communication.Moreover, the communication is on a hybrid of cellular network andnon-cellular network. The wireless connection between devices 102 and103 is based on their non-cellular interfaces, by way of non-limitingexamples, such as Wi-Fi interfaces, Bluetooth interfaces, LTE-Directinterfaces, optical interfaces, or infrared interfaces. The wirelessconnection between cellular base station 101 and device 102 is based onthe cellular network, where the cellular communication resources ofdevice 102 (by way of non-limiting examples, such as bandwidth and datarate) are shared with the device 103.

Similarly, with reference to FIG. 1, the wireless device 104 does nothave optimal cellular signals directly connecting to the base station101. However, the device 104 can communicate with the base station 101via three hops: hopping onto the wireless device 105, then onto thewireless device 102, and then onto the base station 101. The wirelesslinks between devices 102, 104 and 105 are based on their non-cellularinterfaces, by way of non-limiting examples, such as Wi-Fi interfaces,Bluetooth interfaces, LTE-Direct interfaces, optical interfaces, orinfrared interfaces. The wireless link between cellular base station 101and device 102 is based on the cellular network, where the cellularcommunication resources of device 102 (by way of non-limiting examples,such as bandwidth and data rate) are shared with the device 104.

In some embodiments, with reference to FIG. 1, the device 102 canconcurrently relay signals originated from devices 103 and 104. In someembodiments, the device 102 can communicate with the base station 101for its own use, while relaying signals from one of the devices 103 and104 or from both of the devices 103 and 104.

In some cases embodied in FIG. 1, the wireless links in the non-cellularnetwork can operate on the same protocol. In some cases, the links canoperate on different protocols. By way of non-limiting examples,suitable protocol options are IEEE 802.11 standards, AP/AP protocols,STA/STA protocols, AP/STA protocols, AP/IBS S protocols, STA/IBSSprotocols, AP/P2P-client protocols, AP/P2P-GO protocols, IBSS/IBSSprotocols, P2P-GO/P2P-GO protocols, and P2P-Client/P2P-Client protocols,P2P-GO/STA protocols, STA/P2P-Client protocols, P2P-GO/IBSS protocols,P2P-Client/IBSS protocols, and P2P-GO/P2P-Client protocols. Those withskills in the art can recognize various combinations of protocols can beembodied in the subject matter described herein.

Sink/Relaying/Node Device

In some embodiments, the media, devices, networks, systems, and methodsdescribed herein include a wireless device as a sink device. A sinkdevice in multi-hop, hybrid networks is a wireless device that has adirect wireless link to a cellular base station and that relays signalsof other wireless devices. In the embodiments shown in FIG. 1, thedevice 102 is a sink device. The sink device is a gateway point betweencellular networks and non-cellular networks. It enables other wirelessdevices in a non-cellular network to access a cellular network; in otherwords, sink devices enable other wireless devices to participate in thehybrid network. In some embodiments, there will be more than one sinkdevice to enable the connections between cellular and non-cellularnetworks.

In some embodiments, the media, devices, networks, systems, and methodsdescribed herein include a wireless device as a node device. Referringto FIG. 1, devices 103 and 104 are node devices. A node device does nothave an optimal direct connection to the cellular base station 101 andis an end terminal in the path of its communication to the cellular basestation 101. In some embodiments of multi-hop, hybrid networks shown inFIG. 1, the node device 103 requests the upstream device 102 to relay acommunication to the cellular base station 101; because the device 102is a sink device, the device 103 can achieve the communication based ontwo hops. Similarly, the node device 104 requests the upstream device105 to relay the signals. However, the device 105 does not have anoptimal direct connection to the base station 101, so it furtherrequests the device 102 for relaying the signals. It turns out that thedevice 104 spends three hops in order to connect to the base station101. In some embodiments, a node device connects to a cellular basestation in many hops, as long as the relaying devices are able toachieve the relaying task.

In some embodiments, the media, devices, networks, systems, and methodsdescribed herein include a wireless device as a relaying device.Referring to FIG. 1, a relaying device is the wireless device 105 thatis an intermediary device in a communication path. The device 105 can beconfigured to communicate with the downstream wireless device 104 andthe upstream wireless device 102. In some embodiments, the relayingdevice 105 can relay multiple communication paths. In some embodiments,the wireless connections between the device 105 and other devices 102and 104 use a same protocol or use distinct protocols.

There are various conditions for the sink/relaying devices to relay thecommunication. By way of non-limiting examples, suitable conditions arebattery life, bandwidth usages, device types, node-state signals, levelsof mobility, time of day, subscription fees, user profiles, non-cellularsignal strengths, cellular signal strengths, noise levels, and/orinterference levels. By way of non-limiting examples, a battery lifeincludes an amount of energy available, an amount of battery storagecapacity, an amount of remaining unexhausted energy, an estimated use oftime/energy for conducting hopping, the current usage pattern ofbatteries, an absolute amount of energy stored, an amount of fluidremaining in a reservoir (e.g., an amount of hydrogen or methane in afuel cell). By way of non-limiting examples, bandwidth usages includesavailable bandwidth for establishing wireless links, an uplink availablebandwidth, a downlink available bandwidth, and an estimated usage ofbandwidth; the aforementioned bandwidths include cellular bandwidths andnon-cellular bandwidths. By way of non-limiting examples, a device typeincludes a machine type (e.g., phone, tablet computing device, laptop,server, desktop computer), a number of processor cores, an amount ofmemory in the device, a number of antennas coupled to a cellularinterface of the device, a number of antennas coupled to a non-cellularinterface of the device, and an operating system type. By way ofnon-limiting examples, a node-state signal (e.g., a beacon signal)contains information regarding a number of hops between the device and acellular base station, an identifier of a cellular network operator,signal strength of a cellular base station at a gateway device or at asink device, a location of the device, movement of the device, availablecellular/non-cellular bandwidth for hopping, a number of hops, estimatedpath loss, a channel quality indicator, a number of cellular basestations available, a ratio of energy-per-bit to noise-per-bit, signalquality, an RSSI value, an RCPI value, and a number of wireless devicesalready participating in a channel. By way of non-limiting examples, alevel of mobility includes sensing through components of a wirelessdevice, detecting position and changes of position, and calculating aDoppler shift of wireless signals received by the wireless device. Byway of non-limiting examples, a time of day includes the time relativeto usage profiles and a time relative to busy hours. By way ofnon-limiting examples, subscription fees include an amount that thedevice user has promised to pay a cellular network operator. By way ofnon-limiting examples, user profiles includes user behaviors, a user'srelationship with the cellular network operator, a type of customer(e.g., long-term customer, or pay-on-the go customer), and a number ofyears having used the network service provider. By way of non-limitingexamples, an interference level includes cellular interference levelsand non-cellular interference levels.

Interface

In some embodiments, the media, devices, networks, systems, and methodsdescribed herein include using one or more interfaces for cellular,non-cellular, and/or beaconing communications. An interface is ahardware module, implemented by an electronic circuitry, to generate andreceive an electromagnetic wave. In some cases, the implementation ofthe interface belongs to part of an electronic circuitry. By way of anon-limiting example, the electromagnetic wave comprises aradiofrequency wave, a light beam, and/or an infrared wave. In somecases, the interface further includes an electronic circuitry forcontrolling the electromagnetic waveform modulation, demodulation,encoding, decoding, generation, and/or receiving. The controllingmechanisms are implemented by a hardware module, by a software module,or by a combination of hardware and software modules.

In cellular communications, a cellular interface is the interface forconnecting a device to a cellular base station. The cellular interfaceis able to perform a cellular communication with a required protocol. Insome embodiments, the cellular interface is dynamically configured toexecute distinct cellular communication technologies and protocols, byway of non-limiting examples, such as Global System for MobileCommunications (GSM), General Packet Radio Service (GPRS), Enhanced DataRates for GSM Evolution (EDGE), Universal Mobile TelecommunicationsSystem (UMTS), Code Division Multiple Access (CDMA), Wideband CodeDivision Multiple Access (W-CDMA), High Speed Packet Access (HSPA), LongTerm Evolution (LTE), Long Term Evolution Advanced (LTE Advance), LongTerm Evolution Direct (LTE Direct), and Worldwide Interoperability forMicrowave Access (WiMAX).

In some embodiments, the media, devices, networks, systems, and methodsdescribed herein include using a non-cellular interface for non-cellularnetwork connections. The non-cellular interface is able to perform arequired protocol to connect itself to another device in a non-cellularnetwork. In the industry of information technology, non-cellularinterfaces are frequently referred to as wireless interfaces. Examplesof non-cellular networks include, but not limited to, wireless localarea networks, wireless wide area networks, Bluetooth networks, andinfrared networks. In some embodiments, the non-cellular interface isdynamically configured to execute one or more distinct non-cellularcommunication technologies and protocols, by way of non-limitingexamples, such as IEEE 802.11 standards, IEEE 802.16 standards, AP/STAprotocols, Independent Basic Service Set (IBSS), Peer-to-Peer (P2P),P2P-GO/P2P-Client, Long Term Evolution Direct (LTE Direct), WorldwideInteroperability for Microwave Access (WiMAX), IEEE 802.16, MobileMulti-Hop Relay (MMR) Bluetooth, and FlashLinQ.

In some embodiments, the media, devices, networks, systems, and methodsdescribed herein include using a beacon interface for sending andreceiving beacon signals. In certain embodiments, the beacon interfaceis the same as a non-cellular interface, or a cellular interface. Inother embodiments, the beacon interface shares part of the circuitry ofa non-cellular interface or a cellular interface. Alternatively, thebeacon interface is an isolated circuitry independent of a cellularinterface and independent of a non-cellular interface, such as, by wayof non-limiting examples, devices under standards of IEEE 802.11pstandard, LTE-Direct, and FlashLinQ.

Virtual Interface

In some embodiments, the media, devices, networks, systems, and methodsdescribed herein include using one or more interfaces of asink/relaying/node device for cellular, non-cellular, and/or beaconingcommunications. An interface comprises a hardware module, softwaremodule, or a combination of hardware and software modules. However,appropriately controlling the interface and scheduling various tasksrunning on the interface can virtually create multiple interfaces on thewireless device, allowing the interface to simultaneously executedifferent tasks. The tasks include, by way of non-limiting examples,transmitting/receiving beacon signals, establishing wireless links,maintaining wireless links, routing data frames, switching data frames,directing data frames, readdressing data frames, reassembling dataframes, and handling one or more protocols. The tasks are realized byanother hardware module, or they are implemented by a software module.

In an embodiment, a non-cellular/wireless interface contains commonresources for the purpose of non-cellular communication, which include,by way of non-limiting examples, signal processors, antennas,oscillators, resonators, amplifiers, transmitters, receivers,modulators, demodulators, encoders, decoders, logic components, and/orbus connections. The subject matter described herein can configure thecommon resource to perform multiple tasks in parallel. This process isequivalent to creating virtual non-cellular interfaces where eachvirtual non-cellular interface can execute an independent task. By wayof non-limiting examples, the virtual interface can connect to anon-cellular access point using the STA protocol, the virtual interfacecan connect to a wireless device using the P2P-GO or P2P-Clientprotocol, and the virtual interface can connect to another wirelessdevice using the AP or STA protocol. Those of skill in the art canrecognize various communication protocols to be implemented on a virtualinterface.

In some embodiments, one virtual non-cellular interface is created forhandling a communication with an access point, and another virtualcellular interface is created for transferring/relaying/originating datacommunication. In some embodiments, more than two non-cellular virtualinterfaces are created, where a third non-cellular virtual interface isused to communicate with another access point or to communicate with oneor more downstream devices.

In some embodiments, a cellular interface contains common resources forthe purpose of cellular communication. The resources include, by way ofnon-limiting examples, signal processors, antennas, oscillators,resonators, amplifiers, transmitters, receivers, modulators,demodulators, encoders, decoders, logic components, and/or busconnections. The subject matter described herein can configure thecommon resources to perform multiple tasks in parallel. This process isequivalent to creating virtual cellular interfaces, where each virtualcellular interface can execute an independent task. By way ofnon-limiting examples, the virtual interface can connect to a cellularbase station using the HSPA protocol, the virtual interface can connectto another cellular base station using LTE protocol, and the virtualinterface can perform a beaconing task.

In some embodiments, one virtual cellular interface is created forhandling voice communication, and another virtual cellular interface iscreated for handling data communication.

In some embodiments, a wireless device (e.g., sink device, relayingdevice, and/or originating device) in a communication path utilizes twoor more virtual interfaces to create multiple links which concurrentlyoperate distinct protocols or the same protocol for linking anotherwireless device (e.g., a downstream device, an upstream device, and/oranother non-cellular station/access point).

Wireless Links

In some embodiments, the media, devices, networks, systems, and methodsdescribed herein comprise establishing and/or maintaining a wirelesslink. Establishing/maintaining a wireless link is performed by aninterface or by a virtual interface. Concurrentlyestablishing/maintaining two or more wireless links is performed by twoor more virtual interfaces that are configured on a single interface.Establishing/maintaining a wireless link comprises transmitting wirelesssignals and receiving wireless signals until the end of a communicationsession. Establishing/maintaining a wireless link comprises transmittingwireless signals and receiving wireless signals until the end of acommunication session. Transmitting wireless signals includes, but notlimited to, dissembling data files into data packets, encoding the data,modulating bit streams, and/or generating electromagnetic waves.Receiving wireless signals includes, but not limited to, receivingelectromagnetic waves, demodulating waves, decoding bit streams, and/orassembling data packets into data files. In further embodiments,establishing wireless links is conditioned on some conditions. By way ofnon-limiting examples, suitable conditions are battery life, bandwidthusages, device types, node-state signals, levels of mobility, time ofday, subscription fees, user profiles, non-cellular signal strengths,cellular signal strengths, noise levels, and/or interference levels. Byway of non-limiting examples, a battery life includes an amount ofenergy available, an amount of battery storage capacity, an amount ofremaining unexhausted energy, an estimated use of time/energy forconducting hopping, the current usage pattern of batteries, an absoluteamount of energy stored, an amount of fluid remaining in a reservoir(e.g., an amount of hydrogen or methane in a fuel cell). By way ofnon-limiting examples, bandwidth usages include available bandwidth forestablishing wireless links, an uplink available bandwidth, a downlinkavailable bandwidth, and an estimated usage of bandwidth; theaforementioned bandwidths include cellular bandwidths and non-cellularbandwidths. By way of non-limiting examples, a device type includes amachine type (e.g., phone, tablet computing device, laptop, server,desktop computer), a number of processor cores, an amount of memory inthe device, a number of antennas coupled to a cellular interface of thedevice, a number of antennas coupled to a non-cellular interface of thedevice, and an operating system type. By way of non-limiting examples, anode-state signal (e.g., a beacon signal) contains information regardinga number of hops between the device and a cellular base station, anidentifier of a cellular network operator, signal strength of a cellularbase station at a gateway device or at a sink device, a location of thedevice, movement of the device, available cellular/non-cellularbandwidth for hopping, a number of hops, estimated path loss, a channelquality indicator, a number of cellular base stations available, a ratioof energy-per-bit to noise-per-bit, signal quality, an RSSI value, anRCPI value, and a number of wireless devices already participating in achannel. By way of non-limiting examples, a level of mobility includessensing through components of a wireless device, detecting position andchanges of position, and calculating a Doppler shift of wireless signalsreceived by the wireless device. By way of non-limiting examples, a timeof day includes the time relative to usage profiles and a time relativeto busy hours. By way of non-limiting examples, subscription feesinclude an amount that the device user has promised to pay a cellularnetwork operator. By way of non-limiting examples, user profiles includeuser behaviors, a user's relationship with the cellular networkoperator, a type of customer (e.g., long-term customer, or pay-on-the gocustomer), and a number of years having used the network serviceprovider. By way of non-limiting examples, an interference levelincludes cellular interference levels and non-cellular interferencelevels.

In some embodiments, a wireless device requests another device to relaya cellular communication. The request explicitly sends out a signal, oris embedded in a protocol. The request is implemented in the physicallevel or in the software level. The request is conditioned on some ofthe aforementioned conditions.

Gateway

In some embodiments, the media, devices, networks, systems, and methodsdescribed herein include a computing device as a gateway for datacommunication. When a wireless node device connects to a base stationvia a single-hopping (i.e., direct) link or a multi-hopping (i.e.,indirect) link via a sink device, the base station will furthercommunicate with a gateway in the core cellular network. The gatewayfurther communicates with the Internet directly or indirectly. Referringto FIG. 2, when a node device 201 connects to a cellular base station203 via hopping onto a sink device 202, the base station can communicatewith gateway 204 or 205 in the core network. In the case when the basestation 203 connects to the gateway 204, the gateway directlycommunicates with the Internet 207. Alternatively, when the base station203 connects to the gateway 205, the gateway 205 further communicateswith another gateway 206 that further processes data and connectsdirectly to the Internet 207. Those with skills in the art can recognizethat various layouts can be deployed in the network configurations, andone or more gateways can be placed in the network to conduct the subjectmatter described herein.

By way of non-limiting examples, suitable gateways are Internet protocolsecurity (IPsec) gateway, packet data network gateway (PGW; sometimesreferred to as PDN gateway or packet gateway), serving gateway (SGW),evolved packet data gateway (ePDG), gateway GPRS support node (GGSN),serving GPRS support node (SGSN), and tunnel termination gateway (TTG).In some embodiments, the gateways include the function of proxy servers,domain name servers, firewalls, routers, and switches.

Secure Data Communication

In some embodiments, the media, devices, networks, systems, and methodsdescribed herein include creating a security tunnel for datacommunication. The hopping methods allow node devices to join thecellular networks via non-cellular networks. However, the relayingdevices transferring the data communication between the node devices andthe cellular networks may eavesdrop signals and data packets. Therefore,when multi-hop takes place, in order to secure data communication asecurity tunnel is created between the node devices and the cellularnetwork.

Referring to FIG. 3 where in some embodiments a node device 301 does nothave optimal cellular signals, the node device connects directly to thecellular radio access network 303 to obtain a security key.Alternatively, the node device 301 is pre-configured (non-limitingexamples include: by the cellular network, by a cellular operator, by anend-user, and/or by a certificate authority) with a security key(non-limiting examples include: a fixed security key and/or atime-varying security key). The node device 301 then connects to a sinkdevice 302 via a single hop or multiple hops in order to obtain a higherquality of cellular communication resources. Alternatively, the nodedevice 301 is unable to get a security key before hopping to the sinkdevice 302, so it needs to start with hopping onto the sink device 302in order to obtain a security key from the cellular network.Non-limiting examples where the node device 301 has to perform hoppingto get a security key include: the node device 301 comprises a wirelessdevice that does not contain a cellular interface for cellularcommunication; the node device 301 comprises a wireless device in abasement where cellular signals cannot be reached at all.

Following the previous embodiments, the security key is then used tocreate a security tunnel between the node device 301 and the evolvedpacket data gateway (ePDG) 307. Once the security tunnel is created, thenode device encrypts the data packets and sends the encrypted datapackets to ePDG 307. In some embodiments, the secure communicationbetween the node device 301 and ePDG 307 goes through other gateways, byway of non-limiting examples, such as serving gateway 305 and/or packetgateway 306. The ePDG 307 further decrypts the encrypted data packetsand send the data packets to the Internet. In some embodiments, the datatransmitted to the Internet is sent via another gateway. Referring toFIG. 3, data packets are sent to packet gateway 306 using S2b protocoland then to the Internet.

In some embodiments (see FIG. 3) when data packets are sent from theInternet to the node device 301, the ePDG 307 first receives thepackets, directly from the Internet or via the packet gateway 306. Then,the ePDG 307 encrypts the data packets and transmits the encrypted datapackets to the node device 301 through the security tunnel. When thenode device 301 receives the encrypted data packets, it uses thesecurity key to decrypt the packets.

In further embodiments, the transmission of data packets between thenode device 301 and the gateways involve billing the user of the nodedevice the amount of data packets being sent and received. Using thehopping technologies, the sink devices 302 also relay the same amount ofdata packets sent and received by the node devices, and the packetgateway 306 add a billing record for the sink device 302. However, thecourtesy of the sink device 302 should not be billed for the amount ofrelayed data. Therefore, the ePDG 307 further request the packet gateway306 and/or serving gateway 305 to delete billing records of the sinkdevice 302.

In some embodiments in FIG. 3, the ePDG 307 communicate with theInternet directly, namely without via the packet gateway 306. The ePDG307 request the packet gateway 306 and/or the service serving gateway305 to add billing records for the node device 301 in addition torequesting the deletion of the billing records of the sink device 302.

In some embodiments, the media, devices, networks, systems, and methodsdescribed herein include a deep packet inspection scheme. Referring toFIG. 3, once the node device 301 receives a security key, a securitytunnel can be created between the node device 301 and the ePDG 307.Thus, the node device 301 can encrypt data packets and transmit the datapackets over the security tunnel. When the packet gateway 306 receivesdata packets, it does not add a billing record of the sink device 302,because the destination of the data packets is the ePDG 307; the packetgateway 306 further transfers the data packets to the ePDG 307. When theePDG 307 receives the data packets, it decrypts the data packets andupdates its network connection tables (non-limiting examples include:most recent path table, routing table, ARP table, and/or bearer table).The ePDG 307 sends the decrypted data packets over the S2b-bearers tothe packet gateway 306, which sends the packets to the Internet.

In further embodiments, data packets are transmitted from the Internetto the node device 301. The packet gateway 306 receives the data packetsfrom the Internet and sends them over the S2b-bearers to the ePDG 307.Once the ePDG 307 receives the data packets, it encrypts the datapackets and sends the encrypted data packets over the security tunnel.Meanwhile, the ePDG 307 update the network connections tables. In thesecurity tunnel, the packet gateway 306 receives the encrypted datapackets from the ePDG 307. After inspection, the packet gateway 306 canknow that the packets are being sent (e.g., to the node device 301) fromthe ePDG 307, so it does not add billing records for the sink device 302and further sends the packets (e.g., to the node device 301) via thesink device 302. The node device 301 finally receives the data packetsvia the sink device 302, and decrypts the packets.

In some embodiments, the media, devices, networks, systems, and methodsdescribed herein place the gateway handling encryption and decryption ina different location. With reference to FIG. 4, the node device 401non-cellular hopping onto the sink device 402 are embodied to create asecurity tunnel with an IPsec gateway 406, which is located between theserving gateway 405 and the packet gateway 407. When the node device 401receives a security key, it can create a security tunnel with the IPsecgateway 406. Thus, the node device 401 can encrypt data packets andtransmit the data packets over the security tunnel. When the IPsecgateway 406 receives the data packets, it decrypts the data packets andtransmits the data packets to the Internet via packet gateway 407 usingregular protocols; non-limiting examples include S2, S4, S5, and/or S8protocols. When transmitting data packets from the Internet to the nodedevice 401, the packet gateway 407 receives the packets and forwards thepackets to the IPsec gateway 406. The IPsec gateway encrypts the datapackets and sends them to the node device 401. The node device furtherdecrypts the encrypted data packets. In some further embodiments, theIPsec gateway 406 communicates with: policy and charging rules function(PCRF) using regular protocols (non-limiting examples include Gxc or Gxprotocols), mobility management entity (MME) using regular protocols(non-limiting examples include the S11 protocol), and/or 3GPP AAA serverusing regular protocols (non-limiting examples include the S6bprotocol).

In the embodiments shown in FIG. 5, the node device 501 create asecurity tunnel with the IPsec gateway 505 that is placed beforereaching the serving gateway 506 and the packet gateway 507. When thenode device 501 receives a security key, it can create a security tunnelwith the IPsec gateway 505. Thus, the node device 501 can encrypt datapackets and transmit the data packets over the security tunnel. When theIPsec gateway 505 receives the data packets, it decrypts the datapackets and transmits the data packets to the Internet via the servinggateway 506 and the packet gateway 507 using regular protocols(non-limiting examples include S1 and/or S4 protocols). Whentransmitting data packets from the Internet to the node device 501, theIPsec gateway 505 receives the packets via the serving gateway 506 andthe packet gateway 507. The IPsec gateway 505 further encrypts the datapackets and sends them to the node device 501 which finally decrypts theencrypted data packets. In some further embodiments, the IPsec gateway505 communicate with: policy and charging rules function (PCRF) usingregular protocols (non-limiting examples include the Gxc protocol), homesubscriber server (HSS) using regular protocols (non-limiting examplesinclude the S6a protocol), and/or mobility management entity (MME) usingregular protocols (non-limiting examples include the S11 protocol).

Alternatively, FIG. 6 shows some embodiments where only serving gatewayand packet gateway are available in the core network. The node device601 connects directly to the cellular radio access network 603 to obtaina security key. Alternatively, the node device 601 is pre-configured(non-limiting examples include: by the cellular network, by a cellularoperator, by an end-user, and/or by a certificate authority) with asecurity key (non-limiting examples include: a fixed security key and/ora time-varying security key). The node device 601 then connects to asink device 602 via a single hop or multiple hops in order to obtain ahigher quality of cellular communication resources. Alternatively, thenode device 601 not be able to get a security key before hopping to thesink device 602, so it needs to start with hopping onto the sink device602 in order to obtain a security key from the cellular network.Non-limiting examples where the node device 601 has to perform hoppingto get a security key include: the node device 601 comprises a wirelessdevice that does not contain a cellular interface for cellularcommunication; the node device 601 comprises a wireless device in abasement where cellular signals cannot be reached at all.

Once the node device 601 receives a security key, it can create asecurity tunnel with the packet gateway 606, where the security tunnelutilize a tunneling protocol (non-limiting examples include: dual stackmobile IP (DSMIP [DSMIP can refer to the IPv4 version DSMIPv4, IPv6version DSMIPv6, or a combination of DSMIPv4 and DSMIPv6]) and/or proxymobile IP (PMIP [PMIP can refer to the IPv4 version PMIPv4, IPv6 versionPMIPv6, or a combination of PMIPv4 and PMIPv6]) protocols). Thus, thenode device 601 can encrypt data packets and transmit the data packetsover the security tunnel. When the encrypted data packets arrive at theserving gateway 605, the serving gateway transfer the data to the packetgateway 606. The packet gateway decrypts the data packets and sends thepackets to the Internet. When transmitting data packets from theInternet to the node device 601, the packet gateway 606 receives thepackets and encrypts the packets. The encrypted data packets are sent tothe node device 601 via the serving gateway 605 using regular protocols(non-limiting examples include DSMIP/S2c and/or PMIP/S2a protocols).

Some embodiments with deep packet inspection are applied to the networkconfiguration in FIG. 6. Once the node device 601 obtains a securitykey, a security tunnel (e.g., on DSMIP protocol and/or PMIP protocol)can be created between the node device 601 and the packet gateway 606.Thus, the node device 601 can encrypt data packets and transmit the datapackets over the security tunnel. When the packet gateway 606 receivesthe data packets, it does not add a billing record for the sink device602, because the destination of the data packets is the packet gateway606. The packet gateway 606 decrypts the data packets, updates itsnetwork connection tables (non-limiting examples include: most recentpath table, routing table, ARP table, and/or bearer table), and sendsthe decrypted data packets to the Internet. When data packets aretransmitted from the Internet to the node device 601, the packet gateway606 receives the data packets, updates its network connection tables(non-limiting examples include: most recent path table, routing table,ARP table, and/or bearer table), encrypts the packets, and sends them tothe node device 601. Because the data packets are sourced from thepacket gateway, the packet gateway 606 does not add a billing record forthe sink device 602. Finally, the node device receives the data packetsand decrypts the packets.

The embodiments in FIG. 3, FIG. 4, FIG. 5, and FIG. 6 are non-limitingexamples of possible network configurations. Those skilled in the artcan easily recognize variations of the network configurations forcreating security tunnels between a node device and a core cellularnetwork.

Secure Communication and Roaming

In some embodiments, the media, devices, networks, systems, and methodsdescribed herein include a roaming mechanism. In some networkconfigurations like FIG. 3, the node device 301 has direct access to thecellular network and the security tunnel is necessary. Then, the nodedevice 301 perform the following tasks (in the order, in the reverseorder, or in parallel): (1) connects directly to the cellular networkand sends the data packets to the packet gateway 306; and (2) sends(e.g., indirectly via the sink device 302 over a security tunnel, ordirectly via the cellular network) a signaling to the ePDG 307indicative of roaming from indirect-access (e.g., non-3GPP-access) todirect access (e.g., 3GPP-access). When the ePDG 307 receives theindicative signaling, it sends the indicative signaling and othersignaling (e.g., to modify an S2b-bearer, to modify network connectionstables) via regular protocols (e.g., the S2b-bearers) to the packetgateway 306. The packet gateway 306 perform the following tasks (in theorder, in the reverse order, or in parallel): (1) receives the datapackets from the node device 301 and transmits them to the Internet; and(2) receives all signaling from the ePDG 307 and update its networkconnection tables based on the received signaling. When the packetgateway 306 receives data packets from the Internet, it furthertransmits them to the node device 301.

In some embodiments, the roaming can take place along with securitytunnels, as the following. Referring to FIG. 3, the node device 301perform the following tasks (in the order, in the reverse order, or inparallel): (1) connects indirectly via the sink device 302 to thecellular network, creates a security tunnel with the ePDG 307, encryptsdata packets, and sends the encrypted data packets to the ePDG 307; (2)sends (e.g., indirectly via the sink device 302 over the securitytunnel, or directly via the cellular network) a signaling to the ePDG307 indicative of roaming from direct-access (e.g., 3GPP-access) toindirect access (e.g., non-3GPP-access). The ePDG 307 perform thefollowing tasks: (in the order, in the reverse order, or in parallel):(1) receives the encrypted data packets over the security tunnel fromthe node device 301, decrypts them, and sends them over regularprotocols (e.g., the S2b-bearers) to the packet gateway 306; (2)receives the indicative signaling and sends the indicative signaling andother signaling (e.g., to modify an S2b-bearer, to modify networkconnections tables) via regular protocols (e.g., the S2b-bearers) to thepacket gateway 306. The packet gateway 306 perform the following tasks(in the order, in the reverse order, or in parallel): (1) receives thedecrypted data packets over the S2b-bearers from the ePDG 307 and sendsthem to the Internet; (2) receives all signaling from the ePDG 307 andupdate its network connection tables based on the received signaling.When the packet gateway 306 receives data packets from the Internet, itsends them over regular protocols (e.g., the S2b-bearers) to the ePDG307, which in turn encrypts the data packets and sends the encrypteddata packets over the security tunnel to the node device 301. Uponreceiving the encrypted data packets, the node device 301 decrypts thedata packets.

A roaming mechanism occurs to the embodiments in FIG. 6. Some networkconfigurations like FIG. 6 have the node device 601 with direct accessto the cellular network and the security tunnel is unnecessary. The nodedevice 601 perform the following tasks (in the order, in the reverseorder, or in parallel): (1) connects directly to the cellular networkand sends the data packets to the packet gateway 606; and (2) sends(e.g., indirectly via the sink device 602 over a security tunnel, ordirectly via the cellular network) a signaling to the packet gateway 606indicative of roaming from indirect-access (e.g., non-3GPP-access) todirect access (e.g., 3GPP-access). The packet gateway 606 perform thefollowing tasks (in the order, in the reverse order, or in parallel):(1) receives the data packets from the node device 601 and transmitsthem to the Internet; and (2) receives signaling (e.g., to modify anS2c-bearer, to modify network connections tables) from the node deviceindicative of roaming from indirect-access (e.g., non-3GPP-access) todirect access (e.g., 3GPP-access) and update its network connectiontables based on the received signaling. When the data packets are sentfrom the Internet to the node device 601, the packet gateway 606receives the packets and transmits them to the node device.

In some embodiments, roaming can take place along with security tunnels,described as follows. Referring to FIG. 6, the node device 601 performthe following tasks (in the order, in the reverse order, or inparallel): (1) connects indirectly via the sink device 602 to thecellular network, creates a security tunnel with the packet gateway 606,encrypts data packets, and sends the encrypted data packets to thegateway 606; (2) sends (e.g., indirectly via the sink device 602 overthe security tunnel, or directly via the cellular network) a signalingto the packet gateway 606 indicative of roaming from direct-access(e.g., 3GPP-access) to indirect access (e.g., non-3GPP-access). Thepacket gateway 606 perform the following tasks: (in the order, in thereverse order, or in parallel): (1) receives the encrypted data packetsover the DSMIP security tunnel from the node device 601, decrypts them,and sends them to the Internet; (2) receives signaling (e.g., to modifyan S2c-bearer, to modify network connections tables) from the nodedevice 601 indicative of roaming from direct-access (e.g., 3GPP-access)to indirect access (e.g., non-3GPP-access) and update its networkconnection tables based on the received signaling. When packets aretransmitted from the Internet to the node device 601, the packet gateway606 receives the data packets from the Internet, encrypts the packets,and sends encrypted packets over the DSMIP tunnel to the node device601. Upon receiving the encrypted data packets, the node device 601decrypts the data packets.

Secure Communication and Inter Radio Access Technology

In some embodiments, the media, devices, networks, systems, and methodsdescribed herein include Inter-Radio Access Technology (Inter-RAT). FIG.7 and FIG. 8 show the counterpart embodiments of FIG. 3. In some casesshown in FIG. 7, the node device 701 be a high speed packet access(HSPA) device, and the sink device 702 and the radio access network 703be running long term evolution (LTE) protocols. In addition to the SGW705, there include an SGSN (e.g., that communicates with packet gateway706 using regular protocols such as the S4 protocol) that serves HSPAdevices that communicate directly with the cellular network.Alternatively, in other cases shown in FIG. 8, the node device 801comprises an LTE device, the sink device comprises an HSPA device, andthe cellular radio network access 803 and 804 is HSPA. In addition tothe SGSN service serving gateway 805, there is an SGW (e.g., thatcommunicates with packet gateway 806 using regular protocols such as S5and/or S8 protocols) that serves LTE devices that communicate directlywith the cellular network.

FIG. 9 shows some embodiments under inter-RAT. In the embodiments, thenode device 901 is an HSPA device. The sink device 902 is an LTE deviceand the network 903-906 operates on LTE. The node device 901 can createa security tunnel with tunnel termination gateway (TTG) 907, after thenode device 901 receives a security key. Thus, the node device 901 canencrypt data packets and transmit the data packets over the securitytunnel. When the TTG 907 receives data packets, it decrypts the datapackets and forwards the data packets over regular protocols, forinstance, GPRS tunneling protocol (GTP) to gateway GPRS support node(GGSN) 908, which in turn sends the packets to the Internet. Whentransmitting data packets from the Internet to the node device 901, theGGSN 908 receives the packets and forwards the packets over regularprotocols (e.g., the GTP protocol) to the TTG 907. The TTG encrypts thedata packets and sends them to the node device 901 over the securitytunnel. The node device further decrypts the encrypted data packets.

In further embodiments of FIG. 9, the transmission of data packetsbetween the node device 901 and the gateways involve billing the user ofthe node device the amount of data packets being sent and received.Using the hopping technologies, the sink devices 902 also relay the sameamount of data packets sent and received by the node devices, and thepacket gateway 906 adds a billing record for the sink device 902.However, the courtesy of the sink device 902 should not be billed forthe amount of relayed data. Therefore, the TTG 907 further requests thepacket gateway 906 to delete billing records of the sink device 902.

FIG. 10 shows some embodiments under inter-RAT. In the embodiments, thenode device 1001 is an LTE device. The sink device 1002 is an HSPAdevice and the network 1003-1006 operates on HSPA. The node device 1001can create a security tunnel with ePDG 1007 after receiving a securitykey. Thus, the node device 1001 can encrypt data packets and transmitthe data packets over the security tunnel. When the ePDG 1007 receivesdata packets, it decrypts the data packets and forwards the data packetsover regular protocols (e.g., the S2b protocol) to packet gateway 1008,which in turn sends the packets to the Internet. When transmitting datapackets from the Internet to the node device 1001, the packet gateway1008 receives the packets and forwards the packets to the ePDG 1007. TheePDG encrypts the data packets and sends them to the node device 1001over the security tunnel. The node device further decrypts the encrypteddata packets.

In further embodiments of FIG. 10, the transmission of data packetsbetween the node device 1001 and the gateways involve billing the userof the node device the amount of data packets being sent and received.Using the hopping technologies, the sink devices 1002 also relay thesame amount of data packets sent and received by the node devices, andthe GGSN 1006 adds a billing record for the sink device 1002. However,the courtesy of the sink device 1002 should not be billed for the amountof relayed data. Therefore, the ePDG 1007 further requests the GGSN 1006to delete billing records of the sink device 1002.

In some embodiments, the node devices have a capability to operate onmore than one protocol under inter-RAT. Referring to FIG. 11, the nodedevice 1101 is an LTE device with HSPA capability. The sink device 1102is an HSPA device and the network 1103-1108 operates on HSPA. The nodedevice 1101 can fallback from LTE to HSPA and create a security tunnelwith TTG 1107 after receiving a security key. Thus, the node device 1101can encrypt data packets and transmit the data packets over the securitytunnel. When the TTG 1107 receives data packets, it decrypts the datapackets and forwards the data packets over regular protocols (e.g., theGTP protocol) to GGSN 1106, which in turn sends the packets to theInternet. When transmitting data packets from the Internet to the nodedevice 1101, the GGSN 1106 receives the packets and forwards the packetsto the TTG 1107. The TTG further encrypts the data packets and sendsthem to the node device 1101 over the security tunnel. The node devicefinally decrypts the encrypted data packets.

In further embodiments of FIG. 11, the transmission of data packetsbetween the node device 1101 and the gateways involve billing the userof the node device the amount of data packets being sent and received.Using the hopping technologies, the sink devices 1102 also relay thesame amount of data packets sent and received by the node devices, andthe GGSN 1106 adds a billing record for the sink device 1102. However,the courtesy of the sink device 1102 should not be billed for the amountof relayed data. Therefore, the TTG 1107 further requests the GGSN 1106to delete billing records of the sink device 1102.

In some embodiments, those with skills in the art can recognize thatinter-RAT can mix LTE and Enhanced Data rates for GSM Evolution (EDGE).In some embodiments of FIG. 7 and FIG. 9, the node devices change tooperating on the EDGE protocol. In the embodiments of FIG. 8, FIG. 10and FIG. 11, the cellular network becomes an EDGE network.

In some embodiments, those with skills in the art can recognize thatinter-RAT can mix HSPA and EDGE standards. In some cases of FIG. 11, thenode device operates on EDGE and the network operates on HSPA. In somecases of FIG. 11, the node device operates on HSPA and the networkoperates on EDGE.

Similarly, by way of non-limiting examples, embodiments of FIG. 4 inconjunction with inter-RAT are described below. Referring to FIG. 12, insome embodiments, the node device 1201 operates on HSPA or EDGE, thesink device 1202 and the cellular network 1203-1208 operates on LTE. Insome cases, the serving gateway 1205 is replaced by an SGSN (e.g., thatcommunicates with packet gateway 1207 using regular protocols such asthe S4 protocol) serving HSPA/EDGE devices that communicate directlywith the cellular network. In some cases, the packet gateway 1207 isreplaced by a GGSN. In some embodiments shown in FIG. 13, the nodedevice 1301 operate on LTE, the sink device 1302 and the cellularnetwork 1303-1308 operate on HSPA or EDGE. In addition to the SGSN 1305,there is an SGW (e.g., that communicates with packet gateway 1307 usingregular protocols such as S5 and/or S8 protocols) serving LTE devicesthat communicate directly with the cellular network. Sometimes, thecombination of HSPA and EDGE be embodied: the node device 1301 operateon EDGE, the sink device 1302 and the cellular network 1303-1308 operateon HSPA, and the serving gateway 1305 be replaced by an SGSN; anotheroption is that the node device 1301 operate on HSPA, the sink device1302 and the cellular network 1303-1308 operate on EDGE, and the servinggateway 1305 be replaced by an SGSN

By way of non-limiting examples, possible variations on FIG. 5 aredescribed below. Referring to FIG. 14, in some embodiments, the nodedevice 1401 operates on HSPA or EDGE, the sink device 1402 and thecellular network 1403-1408 operates on LTE. In addition to the SGW 1406,there is an SGSN (e.g., that communicates with packet gateway 1407 usingregular protocols, for example the S4 protocol) that serves HSPA/EDGEdevices that communicate directly with the cellular network. In someembodiments shown in FIG. 15, the node device 1501 operate on LTE, thesink device 1502 and the cellular network 1503-1508 operate on HSPA orEDGE. In addition to the SGSN 1506, there is an SGW (e.g., thatcommunicates with packet gateway 1507 using regular protocols such as S5and/or S8 protocols) that serves LTE devices that communicate directlywith the cellular network. Moreover, the combination of HSPA and EDGE isembodied: the node device 1501 operates on EDGE, the sink device 1502and the cellular network 1503-508 operates on HSPA, and the servinggateway 1506 is replaced by an SGSN; another option comprises that thenode device 1501 can operate on HSPA, the sink device 1502 and thecellular network 1503-1508 operates on EDGE, and the serving gateway1506 is replaced by an SGSN.

By way of non-limiting examples, possible variations on FIG. 6 aredescribed below. Referring to FIG. 6, in some embodiments, the nodedevice 601 operates on HSPA, the sink device 602 and the cellularnetwork 603-607 operates on LTE. In addition to the SGW 605, there is anSGSN (e.g., that communicates with packet gateway 606 using regularprotocols [e.g., the S4 protocol]) that serves HSPA devices thatcommunicate directly with the cellular network. In some embodiments, thenode device 601 operates on LTE, the sink device 602 and the cellularnetwork 603-607 operates on HSPA. In addition to the SGSN 605, there isan SGW (e.g., that communicates with packet gateway 606 using regularprotocols [e.g., S5 and/or S8 protocols]) that serves LTE devices thatcommunicate directly with the cellular network. In some cases, the nodedevice 601 operates on EDGE, the sink device 602 and the cellularnetwork 603-607 operates on LTE. In addition to the SGW 605, there is anSGSN (e.g., that communicates with packet gateway 606 using regularprotocols [e.g., the S4 protocol]) that serves EDGE devices thatcommunicate directly with the cellular network. Alternatively, the nodedevice 601 operates on LTE, the sink device 602 and the cellular network603-607 operates on EDGE. In addition to the SGSN 605, there is an SGW(e.g., that communicates with packet gateway 606 using regular protocols[e.g., S5 and/or S8 protocols]) that serves LTE devices that communicatedirectly with the cellular network. Moreover, HSPA and EDGE is embodied:the node device 601 operates on EDGE, the sink device 602 and thecellular network 603-607 operates on HSPA, and the serving gateway 605is replaced by an SGSN; another option includes that the node device 601can operate on HSPA, the sink device 602 and the cellular network603-607 operates on EDGE, and the serving gateway 605 is replaced by anSGSN.

Most Recent Path Intelligence

In some embodiments, the media, devices, networks, systems, and methodsdescribed herein include most recent path intelligence. Variousembodiments of most recent path intelligence are shown in FIG. 16, FIG.17, and FIG. 18.

FIG. 16 shows a non-limiting example of most recent path intelligence;in this case, the ePDG handles the most recent path tables.

FIG. 17 shows a non-limiting example of most recent path intelligence;in this case, the PGW handles the most recent path tables.

FIG. 18 shows a non-limiting example of most recent path intelligence;in this case, the node device has direct access to the cellular networkand the PGW handles the most recent path tables

Alternating Tunnel Configurations

In some embodiments, the media, devices, networks, systems, and methodsdescribed herein include alternating tunnel configurations to enhancedata communication security. The subject idea is to create a dynamicscheme to enhance communication security, since a static scheme can beeasily deciphered by a third party. In some embodiments, the node devicecan request to reissue a new security key from time to time, so the dataencryption is dynamic. In some embodiments, the node device uses morethan one sink device to communicate with the cellular network; the nodedevice hops to different sink devices from time to time, so thecommunication path stays dynamic. In some embodiments, the node devicerequests to establish the security tunnel with distinct gateways fromtime to time. In some embodiments, the node device chooses one of thenetwork configurations in FIG. 3, FIG. 4, FIG. 5, and FIG. 6; at a latertime, the node device switches to another network configuration. Thosewith skills in the art can further recognize various combinations of theforegoing methods to enhance data communication security.

In some embodiments, a node device switches between using a securitytunnel and not using a security tunnel. In some embodiments when a nodedevice (e.g., a mobile device) moves to a location with a good cellularreception, it can directly connect to the cellular base station withouthopping, directly or indirectly, to a sink device. In this case, thenode device need not establish a secure tunnel and can use a regularcellular communication protocol to connect with the core cellularnetwork. FIG. 19 shows the counterpart embodiments to FIG. 3 without asecurity tunnel. In the embodiments, the node device 1201 connectsdirectly to the cellular network. Without a security tunnel, the datapackets do not flow to the evolved packet data gateway 1207. To senddata packets to the Internet, the communication path starts from thenode device 1201, to the serving gateway 1205, to the packet gateway1206, and to the Internet. To receive data packets, the communicationpath is in the reverse order. In further embodiments, the node devicehave an option to hop onto a sink device where a security tunnel has tobe established, as shown in FIG. 3; thus, the node device can alternatethe network configurations between FIG. 3 and FIG. 19.

Data Protocol

In some embodiments, the media, devices, networks, systems, and methodsdescribed herein include a data protocol associated with a securitytunnel. In further embodiments, the data protocol includes billingrecords processing. The transmission of data packets between a nodedevice and a gateway involves charging the user of the node device theamount of data packets being sent and received. Using the hoppingtechnologies, a sink/relaying device allowing the node device to hoponto the non-cellular network also transfers the same amount of datapackets sent and received by the node device. However, the courtesy ofthe sink/relaying device should not be billed for the amount of relayeddata. Therefore, the data protocol requests a gateway to delete abilling record of the sink/relaying device.

Some embodiments of data protocol of FIG. 3 are illustrated in FIG. 20.Referring to FIG. 20 where a security tunnel 2009 is created between thenode device 2001 and the evolved data packet gateway (ePDG) 2007. Thecommunication between the node device 2001 and the sink device 2002 isbased on a single hop or multiple hops in the non-cellular network, andthe communication between the sink device 2002 and ePDG 2007 is based onthe cellular network. To send a data packet, referring to the step 2011,the node device 2001 uses a security key to encrypt the data packet andindicates the inner source port and outer source port as W (i.e., theport in the node device 2001) and the inner source IP and outer sourceIP as ND (i.e., the IP address of the node device 2001). In the step2012, the sink device 2002 transfers the data packet by indicating theinner source port as W, the inner source IP as ND, the outer source portas X (i.e., the port in the sink device 2002), and the outer source IPas SD (i.e., the IP address of the sink device 2002). When the ePDG 2007receives the data packet, it will update its network connection tables;non-limiting examples of the tables include: most recent path tables,routing tables, address resolution protocol tables, bearer-tables,firewall tables, IP tables, and edge bridge tables. Because the datapacket was originated by the node device 2001, the packet gateway 2006should not charge the packet sent by the sink device 2002. In the step2013, ePDG 2007 requests the packet gateway 2006 to delete the billingrecord of the sink device 2002. Meanwhile, the ePDG 2007 untunnels thedata packet, decrypts the data packet, and forwards the data packet tothe Internet directly (in which case the ePDG 2007 further request thepacket gateway 2006 to add the corresponding billing record for the nodedevice 2001), or via the packet gateway 2008 (e.g., packet gateway 2008is the same as packet gateway 2006, or packet gateway 2008 is differentfrom packet gateway 2006); in the step 2014, the ePDG 2007 indicatesinner source port as W and inner source IP as ND.

Referring to FIG. 20 when a data packet sent from the Internet isreceived by the ePDG 2007, the data packet in the step 2015 indicatesthe inner destination port as W and the inner destination IP as ND. TheePDG 2007 tunnels the data packet, encrypts the data packet, andtransmits the encrypted data packet to the node device 2001 via the sinkdevice 2002. In the step 2016, the ePDG 2007 requests the packet gateway2006 to delete the billing record of the sink device 2002, because thesink device is used to transfer data only. In the step 2017, the datapacket includes the following information: inner destination port as W,inner destination IP as ND, outer destination port as X, and outerdestination IP as SD. In the step 2018, the sink device 2002 transfersthe data packet by indicating the inner destination port as W, innerdestination IP as ND, outer destination port as W, outer destination IPas ND. When the node device 2001 receives the data packet, it uses thesecurity key to decrypt the data packet.

In some embodiments illustrated in FIG. 20, the media, devices,networks, systems, and methods described herein include one or morerelaying devices between the node device 2001 and the sink device 2002,the ePDG also request the packet gateway 2006 to delete billing recordsof the relaying devices.

In some embodiments illustrated in FIG. 20, the media, devices,networks, systems, and methods described herein include deep packetinspection. A non-limiting example is described as follows. The packetgateway (e.g. PGW) uses deep packet inspection (e.g. a whitelist rule)so that it does not create billing records for tunneled packets (e.g.IPsec tunneled packets) destined to (e.g. destination IP address of thetunneled packets matches that of the tunneling gateway) or sourced from(e.g. source IP address of the tunneled packets matches that of thetunneling gateway) the tunneling gateway (e.g. ePDG, PGW).

In some further embodiments, the steps 2013 and 2016 of deleting billingrecord of the sink device 2002 are not be required. In some embodimentsillustrated in FIG. 20, the media, devices, networks, systems, andmethods described herein include network address translation (NAT)(e.g., source-NAT, destination-NAT, IPv4-to-IPv6-NAT, and/orIPv6-to-IPv4-NAT) at one or more of the gateways (e.g., serving gateway,packet gateway, and/or ePDG). Then, the inner-and/or-outersource-and/or-destination ports of the data packet are modified at oneor more of the gateways. Then, the inner-and/or-outersource-and/or-destination IP-addresses of the data packet are modifiedat one or more of the gateways.

Some embodiments of data protocol of FIG. 6 are illustrated in FIG. 21.Referring to FIG. 21 where a security tunnel 2107 is created between thenode device 2101 and the packet gateway 2106. The communication betweenthe node device 2101 and the sink device 2102 is based on a single hopor multiple hops in the non-cellular network, and the communicationbetween the sink device 2102 and packet gateway 2106 is based on thecellular network. To send a data packet, referring to the step 2108, thenode device 2101 uses a security key to encrypt the data packet andindicates the inner source port and outer source port as W (i.e., theport in the node device 2101) and the inner source IP and outer sourceIP as ND (i.e., the IP address of the node device 2101). In the step2109, the sink device 2102 transfers the encrypted data packet byindicating the inner source port as W, the inner source IP as ND, theouter source port as X (i.e., the port in the sink device 2102), and theouter source IP as SD (i.e., the IP address of the sink device 2102).When the packet gateway 2106 receives the data packet, it will updateits network connection tables; non-limiting examples of the tablesinclude: most recent path tables, routing tables, address resolutionprotocol tables, bearer-tables, firewall tables, IP tables, and edgebridge tables. Because the data packet was originated by the node device2101, the packet gateway 2106 should not charge the packet sent by thesink device 2102, so it deletes the billing record of the sink device inthe step 2110. Meanwhile, the packet gateway 2106 untunnels the datapacket, decrypts the data packet, and forwards the data packet to theInternet in the step 2111, where the packet gateway 2106 indicates innersource port as W and inner source IP as ND.

Referring to FIG. 21, a data packet in the step 2112 sent from theInternet is received by the packet gateway 2106. The data packetindicates the inner destination port as W and the inner destination IPas ND. In the step 2113, the packet gateway 2106 deletes the billingrecord of the sink device 2102, because the sink device is used totransfer data only. The packet gateway 2106 tunnels the data packet,encrypts the data packet, and transmits the encrypted data packet to thenode device 2101 via the sink device 2102. In the step 2114, the datapacket includes the following information: inner destination port as W,inner destination IP as ND, outer destination port as X, and outerdestination IP as SD. In the step 2115, the sink device 2102 transfersthe data packet by indicating the inner destination port as W, innerdestination IP as ND, outer destination port as W, outer destination IPas ND. When the node device 2101 receives the data packet, it uses thesecurity key to decrypt the data packet.

In some embodiments illustrated in FIG. 21, the media, devices,networks, systems, and methods described herein include one or morerelaying devices between the node device 2101 and the sink device 2102,the packet gateway 2106 also delete the billing records of the relayingdevices.

In some embodiments illustrated in FIG. 21, the media, devices,networks, systems, and methods described herein include deep packetinspection. Then, the steps 2110 and 2113 of deleting billing records ofthe sink device 2102 is be required. In some embodiments illustrated inFIG. 21, the media, devices, networks, systems, and methods describedherein include network address translation (NAT) (e.g., source-NAT,destination-NAT, IPv4-to-IPv6-NAT, and/or IPv6-to-IPv4-NAT) at one ormore of the gateways (e.g., serving gateway and/or packet gateway).Then, the inner-and/or-outer source-and/or-destination ports of the datapacket are modified at one or more of the gateways. Then, theinner-and/or-outer source-and/or-destination IP-addresses of the datapacket are modified at one or more of the gateways.

Those with skills in the art can recognize that the data protocols canbe appropriately adjusted according to the network configurations.

Non-Transitory Computer Readable Storage Medium

In some embodiments, the media, devices, networks, systems, and methodsdescribed herein include one or more non-transitory computer readablestorage media encoded with a program including instructions executableby the operating. In further embodiments, a computer readable storagemedium is a tangible component of a digital processing device. In stillfurther embodiments, a computer readable storage medium is optionallyremovable from a digital processing device. In some embodiments, acomputer readable storage medium includes, by way of non-limitingexamples, CD-ROMs, DVDs, flash memory devices, solid state memory,magnetic disk drives, magnetic tape drives, optical disk drives, cloudcomputing systems and services, and the like. In some cases, the programand instructions are permanently, substantially permanently,semi-permanently, or non-transitorily encoded on the media.

Computer Program

In some embodiments, the media, devices, networks, systems, and methodsdescribed herein include at least one computer program, or use of thesame. A computer program includes a sequence of instructions, executablein the digital processing device's CPU, written to perform a specifiedtask. Computer readable instructions be implemented as program modules,such as functions, objects, Application Programming Interfaces (APIs),data structures, and the like, that perform particular tasks orimplement particular abstract data types. In light of the disclosureprovided herein, those of skill in the art will recognize that acomputer program may be written in various versions of variouslanguages.

The functionality of the computer readable instructions may be combinedor distributed as desired in various environments. In some embodiments,a computer program comprises one sequence of instructions. In someembodiments, a computer program comprises a plurality of sequences ofinstructions. In some embodiments, a computer program is provided fromone location. In other embodiments, a computer program is provided froma plurality of locations. In various embodiments, a computer programincludes one or more software modules. In various embodiments, acomputer program includes, in part or in whole, one or more webapplications, one or more mobile applications, one or more standaloneapplications, one or more web browser plug-ins, extensions, add-ins, oradd-ons, or combinations thereof.

Mobile Application

In some embodiments, a computer program includes a mobile applicationprovided to a wireless device. In some embodiments, the mobileapplication is provided to a mobile digital processing device at thetime it is manufactured. In other embodiments, the mobile application isprovided to a mobile digital processing device via the computer networkdescribed herein.

In view of the disclosure provided herein, a mobile application iscreated by techniques known to those of skill in the art using hardware,languages, and development environments known to the art. Those of skillin the art will recognize that mobile applications are written inseveral languages. Suitable programming languages include, by way ofnon-limiting examples, C, C++, C#, Objective-C, Java™, Javascript,Pascal, Object Pascal, Python™, Ruby, VB.NET, WML, and XHTML/HTML withor without CSS, or combinations thereof.

Suitable mobile application development environments are available fromseveral sources. Commercially available development environmentsinclude, by way of non-limiting examples, AirplaySDK, alcheMo,Appcelerator®, Celsius, Bedrock, Flash Lite, .NET Compact Framework,Rhomobile, and WorkLight Mobile Platform. Other development environmentsare available without cost including, by way of non-limiting examples,Lazarus, MobiFlex, MoSync, and Phonegap. Also, mobile devicemanufacturers distribute software developer kits including, by way ofnon-limiting examples, iPhone and iPad (iOS) SDK, Android™ SDK,Blackberry® SDK, BREW SDK, Palm® OS SDK, Symbian SDK, webOS SDK, andWindows® Mobile SDK.

Those of skill in the art will recognize that several commercial forumsare available for distribution of mobile applications including, by wayof non-limiting examples, Apple® App Store, Android™ Market, Blackberry®App World, App Store for Palm devices, App Catalog for webOS, Windows®Marketplace for Mobile, Ovi Store for Nokia® devices, Samsung® Apps, andNintendo® DSi Shop.

Standalone Application

In some embodiments, a computer program includes a standaloneapplication, which is a program that is run as an independent computerprocess, not an add-on to an existing process, e.g., not a plug-in.Those of skill in the art will recognize that standalone applicationsare often compiled. A compiler is a computer program(s) that transformssource code written in a programming language into binary object codesuch as assembly language or machine code. Suitable compiled programminglanguages include, by way of non-limiting examples, C, C++, Objective-C,COBOL, Delphi, Eiffel, Java™, Lisp, Python™, Visual Basic, and VB .NET,or combinations thereof. Compilation is often performed, at least inpart, to create an executable program. In some embodiments, a computerprogram includes one or more executable complied applications.

Software Modules

In some embodiments, the media, devices, networks, systems, and methodsdisclosed herein include software, server, and/or database modules, oruse of the same. In view of the disclosure provided herein, softwaremodules are created by techniques known to those of skill in the artusing machines, software, and languages known to the art. The softwaremodules disclosed herein are implemented in a multitude of ways. Invarious embodiments, a software module comprises a file, a section ofcode, a programming object, a programming structure, or combinationsthereof. In further various embodiments, a software module comprises aplurality of files, a plurality of sections of code, a plurality ofprogramming objects, a plurality of programming structures, orcombinations thereof. In various embodiments, the one or more softwaremodules comprise, by way of non-limiting examples, a web application, amobile application, and a standalone application. In some embodiments,software modules are in one computer program or application. In otherembodiments, software modules are in more than one computer program orapplication. In some embodiments, software modules are hosted on onemachine. In other embodiments, software modules are hosted on more thanone machine. In further embodiments, software modules are hosted oncloud computing platforms. In some embodiments, software modules arehosted on one or more machines in one location. In other embodiments,software modules are hosted on one or more machines in more than onelocation.

Databases

In some embodiments, the media, devices, networks, systems, and methodsdisclosed herein include one or more databases, or use of the same. Inview of the disclosure provided herein, those of skill in the art willrecognize that many databases are suitable for storage and retrieval ofnetwork connections tables, billing records, battery life, bandwidthusages, types of devices, levels of mobility, time of day, subscriptionfees, user profiles, non-cellular signal strengths, cellular signalstrengths, noise levels, and interference levels.

What is claimed is:
 1. A computer-implemented method comprising: a)connecting a wireless device to a cellular network by single-hopping ormulti-hopping to a sink device in a non-cellular network, wherein thesink device has a direct wireless link to a cellular base station; b)establishing a security tunnel between the wireless device and a firstgateway through the sink device and the cellular base station; c)encrypting, by the wireless device, a first data packet, and generatingan encrypted first data packet; d) sending, by the wireless device, theencrypted first data packet over the security tunnel to the firstgateway; e) receiving, by the first gateway, the encrypted first datapacket; f) decrypting, by the first gateway, the encrypted first datapacket, and generating a decrypted first data packet; g) updating, bythe first gateway, a network connection table; h) sending, by the firstgateway, the decrypted first data packet to a second gateway; and i)sending, by the second gateway, the decrypted first data packet to theInternet.
 2. The method of claim 1 further comprising one or more of thefollowing: a) sending, by the first gateway, a request to the secondgateway to delete a billing record of the sink device; and b) performingdeep packet inspection, by the second gateway, and not creating thebilling record of the sink device.
 3. The method of claim 1, wherein thefirst gateway comprises one or more of the following: an evolved packetdata gateway and a tunnel termination gateway.
 4. The method of claim 1,wherein the second gateway comprises one or more of the following: apacket data network gateway and a gateway GPRS support node.
 5. Themethod of claim 1, wherein the establishing the security tunnel is basedon a key assigned to the wireless device by the cellular network.
 6. Acomputer-implemented method comprising: a) connecting a wireless deviceto a cellular network by single-hopping or multi-hopping to a sinkdevice in a non-cellular network, wherein the sink device has a directwireless link to a cellular base station; b) establishing a securitytunnel between the wireless device and a first gateway through the sinkdevice and the cellular base station; c) receiving, by a second gateway,a second data packet from the Internet; d) sending, by the secondgateway, the second data packet to the first gateway; e) encrypting, bythe first gateway, the second data packet, and generating an encryptedsecond data packet; f) sending, by the first gateway, the encryptedsecond data packet over the security tunnel to the wireless devicethrough the sink device; g) receiving, by the wireless device, theencrypted second data packet; and h) decrypting, by the wireless device,the encrypted second data packet and generating a decrypted second datapacket.
 7. The method of claim 6, further comprising one or more of thefollowing: a) sending, by the first gateway, a request to the secondgateway to delete a billing record of the sink device; and b) performingdeep packet inspection, by the second gateway, and not creating thebilling record of the sink device.
 8. The method of claim 6, wherein thefirst gateway comprises one or more of the following: an evolved packetdata gateway and a tunnel termination gateway.
 9. The method of claim 6,wherein the second gateway comprises one or more of the following: apacket data network gateway and a gateway GPRS support node.
 10. Themethod of claim 6, wherein the establishing the security tunnel is basedon a key assigned to the wireless device by the cellular network.
 11. Asystem comprising: a) a wireless device comprising a processor and amemory and configured to connect to a cellular network by single-hoppingor multi-hopping to a sink device in a non-cellular network, wherein thesink device has a direct wireless link to a cellular base station; b) afirst gateway configured to establish a security tunnel between thewireless device and the first gateway through the sink device and thecellular base station; and c) a second gateway; wherein: the wirelessdevice is further configured to: (1) encrypt a first data packet andgenerate an encrypted first data packet; and (2) send the encryptedfirst data packet over the security tunnel to the first gateway; and thefirst gateway is further configured to: (1) receive the encrypted firstdata packet; (2) decrypt the encrypted first data packet and generate adecrypted first data packet; (3) update a network connection table; and(4) send the decrypted first data packet to the second gateway; and thesecond gateway is configured to: send the decrypted first data packet tothe Internet.
 12. The system of claim 11 further comprising one or moreof the following: a) the first gateway is configured to send a requestto the second gateway to delete a billing record of the sink device; andb) the second gateway is configured to perform deep packet inspectionand does not create the billing record of the sink device.
 13. Thesystem of claim 11, wherein the first gateway comprises one or more ofthe following: an evolved packet data gateway and a tunnel terminationgateway.
 14. The system of claim 11, wherein the second gatewaycomprises one or more of the following: a packet data network gatewayand a gateway GPRS support node.
 15. The system of claim 11, wherein theestablishing the security tunnel is based on a key assigned to thewireless device by the cellular network.
 16. A system comprising: a) awireless device comprising a processor and a memory and configured toconnect to a cellular network by single-hopping or multi-hopping to asink device in a non-cellular network, wherein the sink device has adirect wireless link to a cellular base station; b) a first gatewayconfigured to establish a security tunnel between the wireless deviceand the first gateway through the sink device and the cellular basestation; and c) a second gateway; wherein: the second gateway isconfigured to: (1) receive a second data packet from the Internet; and(2) send the second data packet to the first gateway; the first gatewayis further configured to: (1) encrypt the second data packet andgenerate an encrypted second data packet; and (2) send the encryptedsecond data packet over the security tunnel to the wireless devicethrough the sink device; and the wireless device is further configuredto: (1) receive the encrypted second data packet; and (2) decrypt theencrypted second data packet and generate a decrypted second datapacket.
 17. The system of claim 16 further comprising one or more of thefollowing: a) the first gateway is configured to send a request to thesecond gateway to delete a billing record of the sink device; and b) thesecond gateway is configured to perform deep packet inspection and doesnot create the billing record of the sink device.
 18. The system ofclaim 16, wherein the first gateway comprises one or more of thefollowing: an evolved packet data gateway and a tunnel terminationgateway.
 19. The system of claim 16, wherein the second gatewaycomprises one or more of the following: a packet data network gatewayand a gateway GPRS support node.
 20. The system of claim 16, wherein theestablishing the security tunnel is based on a key assigned to thewireless device by the cellular network.